Hacker News Reader

Comment by dan-robertson | Hacker News Reader

Right except on the other hand, look at the whole Dual_EC_DRBG fiasco where the NSA gave instructions for how one could pick parameters, but also offered their own suggestion (in some standards, one had to use the suggested parameters.)

The bit about choosing parameters suggests that the NSA didn’t have a benevolent reason to choose those parameters, and the evidence of that algorithm being exploited in the wild suggests that the NSA may have chosen their parameters with that exploit in mind.

View on HN

The way the Dual_EC_DRBG backdoor worked is that only they (the NSA) could exploit it, they had the equivalent of a master private key.

The NSA has a track record of never putting out Cryptography that could be broken by any other actor than the NSA itself.

"of never putting out Cryptography that could be broken by any other actor than the NSA itself. "

If the only obstacle for others is "unknown Math" - then surely you can rule the script kiddies out, but I believe there are quite some other clever people with strong Math background around, who do not work exclusively for the NSA.

The Dual_EC exploit was possible not because the NSA were cleverer than everyone else but because they wrote the standard and chose the parameters. The parameters involved two points, P and Q, on an elliptic curve group with rank 1 and prime order. Because of these properties there must be some number e such that P = Q^e (written P = e * Q in the common elliptic curve group notation) but it is hard to find e from only P and Q (this is the discrete log problem for this EC group and it, or its close relative the Diffie–Hellman, problem being hard is a common foundation for security in cryptography.) However if you are choosing the parameters, you can just choose Q and e and compute P = Q^e yourself.

The Juniper hack (where their firewall product had a backdoor injected) was enabled by someone breaking into the company and modifying the parameters for Dual_EC_DRBG. It was sufficient for the algorithm to allow for a backdoor for there to be problems. Presumably it would have been caught sooner had the hack required a backdoor to be hidden in the source code and not some bytes that looked like a magic constant.

Dual_EC_DRBG is bad because someone with access to Junipers source repos was able to backdoor their implementation? Do you realise how preposterous that sounds?

> Presumably it would have been caught sooner had the hack required a backdoor to be hidden in the source code and not some bytes that looked like a magic constant.

Have you seen what real life bugdoors look like?

… but that’s exactly the reason Satoshi distrusted the NSA. All else being equal, what possible incentive is there to design Bitcoin in a way that might theoretically be vulnerable to the NSA?

Lots of money? If you can short cut mining, it's cleaner black money than dealing drugs or people, probably. And if you can steal from someone else's address, maybe that's even better... You can seize funds with no red tape. Or mete out that capability to allies etc. Why wouldn't the NSA want to support a parallel financial system that criminals flock to? Just like why wouldn't the NSA want to covertly support encrypted messaging apps or the FBI do that...

If the Bitcoin ecosystem is broken like that, the coins are worthless. You can use an attack like that only once.

There is no such thing. Russia and China have state mathematical capabilities just as good as the US has.

If the standard is that you attach a copy of your message encrypted with an NSA-provided public key, and only the NSA has access to the private key, then being good at math won’t help Russia or China.

Obviously the NSA couldn’t get people to use such a standard but they managed to slip something like that into Dual_EC and had success in getting people to use it.

Reply on news.ycombinator.com